Measuring visitors without privacy risk: analytics and cookie banners in Austria

Before we talk about cookie banners, we ask a different question in our projects: what decision do you want to make with the figures? If you want to know which pages lead to enquiries, you need different data from someone who manages advertising campaigns. And if you never open your analytics anyway, you may not need any at all. This answer determines whether your website needs a banner and which tool fits.

This article describes the legal situation in Austria and how we implement it. It is not legal advice. There is no tool that is “GDPR-compliant” in every configuration. What matters is how it is set up.

When consent is required

Two sets of rules interlock here. The first is Section 165(3) of the Austrian Telecommunications Act 2021 (TKG). It implements the European ePrivacy Directive. Under it, storing or reading information on visitors' devices is only allowed with consent. The exception is anything strictly necessary for a service the visitor has explicitly requested to work. This includes the shopping basket in a shop, a login or storing the cookie choice itself. Analytics is not part of this.

The second is the GDPR. It governs everything that happens to the data after it has been stored or read. The Austrian Data Protection Authority explained this distinction clearly in a talk at the Austrian Economic Chamber (WKO) in 2022. It also stressed there that unique identifiers in cookies can be personal data, even if no name is attached to them.

Consent is subject to the rules of the GDPR: freely given, informed and given by an active action. A pre-ticked box is not enough, as the European Court of Justice ruled in the Planet49 case in 2019. In practice this means that accept and reject sit side by side as equal options. No analytics script loads until consent is given.

What the Data Protection Authority decided on Google Analytics

In December 2021 the Austrian Data Protection Authority ruled on a complaint by the privacy organisation noyb. The decision became public in early 2022. An Austrian website operator had used Google Analytics to transfer personal data to Google in the USA, including user identifiers, IP address and browser data. According to the authority, the standard contractual clauses in place did not offer sufficient protection, because Google, as a US provider, is subject to access by US intelligence services. The transfer therefore violated Art. 44 GDPR.

At its core, the case was about transferring data to the USA, not about cookies. That is exactly where the next development comes in. On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Since then, data may flow to US companies that are certified under this framework. The General Court of the EU dismissed an action against it in September 2025. An appeal against the judgment is pending before the European Court of Justice.

For you, this means two things. Transfers to the USA currently have a legal basis again. But the European Court of Justice struck down both predecessors, Safe Harbor and Privacy Shield. We therefore plan so that a website keeps running even if the framework falls. And the data protection framework never affected the consent requirement for cookies.

Measuring without cookies: what works and where the limit is

There are tools that work without cookies. Matomo can be run on your own server, with cookies switched off and IP addresses shortened. Services such as Plausible state that they are cookieless from the outset. You do give up some things: returning visitors cannot be recognised across several days. For the question of which pages are read and where visitors come from, it is enough.

Even this is not entirely free of open questions. Matomo itself points out that in countries with strict ePrivacy rules, script-based measurement without cookies may also require consent. This is because the script reads information from the browser. France has created an explicit exemption for simple audience measurement, Austria has not. We are not aware of an Austrian decision that clarifies exactly this situation. If you want to avoid any risk, evaluate only the server logs or obtain consent for this as well.

What we set up by default

Our default setting is deliberately minimal. We do not add analytics unless the client asks for it. Fonts are hosted on the website's own server. Videos and maps only load after a click. This way a typical company website manages without a banner, because nothing that requires consent is set or loaded before a visitor takes action.

If you want figures, you get Matomo on a server in the EU, without cookies, with shortened IP addresses and a limited retention period. The privacy policy names the tool and offers a way to opt out. We only set up Google Analytics if there is a specific reason. This is the case, for example, when a shop evaluates Google Ads campaigns. A properly configured banner is then part of the setup.

A side effect: every external script costs loading time. Why this matters is explained in our article on fast websites.

Only measure what changes a decision

With a banner you only see the visitors who consent. How many that is varies with the target group and the design. The figures then show only part of the picture. For a website meant to generate enquiries, a few metrics are usually enough: visits per page, where visitors come from and submitted forms. These three can be measured without cookies. We set up anything beyond that when someone will really use the data.

How we support and evaluate websites after launch is described under Hosting & Support.